0

Im trying to "grasp" how a user should authenticate to our API. Our API is setup to use OpenID Connect thats issued by an ADFS-server. However.. as a "consumer" of our application, whould one expect there to be an endpoint for requesting an access-token? Or should we simply not provide an endpoint for that, and "expect" (with some instructions to our users) that the user requests an access token directly from the ADFS-server?.. whats the common pattern/flow? Since both our API and the ADFS-server is connected to the same domain, we are currently using Single sign on (not sure if that matters, but just providing that information in case it would).

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.